#VU816 Denial of service in Oracle products - CVE-2016-6306 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU816

#VU816 Denial of service in Oracle products - CVE-2016-6306

Published: October 10, 2016 / Updated: April 26, 2017


Vulnerability identifier: #VU816
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-6306
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
OpenSSL
Oracle Solaris
Oracle Linux
Oracle VM VirtualBox
Oracle VM Server for x86
Software vendor:
OpenSSL Software Foundation
Oracle

Description

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakess exists due insufficient length validation of certain TLS/SSL protocol handshake messages. By causing out-of-bounds read error attackers can trigger the affected service deny.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Remediation

Update 1.0.1 to version 1.0.1i.
Update 1.0.2 to version 1.0.2u.

External links